Synchronization with CentOS 9 Stream Release 3 of 8.1.0

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>

0004-Initial-redhat-build.patch

@@ -1,7 +1,7 @@
-From 9dd5bb0af07c962833acf62f8d912c0472224482 Mon Sep 17 00:00:00 2001
+From b8538e2099c040bfe7c98a3af1423abb30d91ab7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
-Subject: [PATCH] Initial redhat build
+Subject: Initial redhat build
 
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
@@ -187,12 +187,27 @@ Merged patches (8.1.0):
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- README.systemtap                        | 43 +++++++++++++++++++++++++
+ .distro/Makefile                        |  100 +
- scripts/qemu-guest-agent/fsfreeze-hook  |  2 +-
+ .distro/Makefile.common                 |   42 +
- scripts/systemtap/conf.d/qemu_kvm.conf  |  4 +++
+ .distro/README.tests                    |   39 +
- scripts/systemtap/script.d/qemu_kvm.stp |  1 +
+ .distro/modules-load.conf               |    4 +
- ui/vnc-auth-sasl.c                      |  2 +-
+ .distro/qemu-guest-agent.service        |    1 -
- 5 files changed, 50 insertions(+), 2 deletions(-)
+ .distro/qemu-kvm.spec.template          | 4860 +++++++++++++++++++++++
+ .distro/rpminspect.yaml                 |    6 +-
+ .distro/scripts/extract_build_cmd.py    |   12 +
+ .distro/scripts/process-patches.sh      |    4 +
+ .gitignore                              |    1 +
+ README.systemtap                        |   43 +
+ scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
+ scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
+ scripts/systemtap/script.d/qemu_kvm.stp |    1 +
+ ui/vnc-auth-sasl.c                      |    2 +-
+ 15 files changed, 5117 insertions(+), 4 deletions(-)
+ create mode 100644 .distro/Makefile
+ create mode 100644 .distro/Makefile.common
+ create mode 100644 .distro/README.tests
+ create mode 100644 .distro/modules-load.conf
+ create mode 100644 .distro/qemu-kvm.spec.template
  create mode 100644 README.systemtap
  create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
  create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
@@ -289,3 +304,6 @@ index 47fdae5b21..2a950caa2a 100644
  
      if (saslErr != SASL_OK) {
          error_setg(errp, "Failed to initialize SASL auth: %s",
+-- 
+2.39.3
+

0005-Enable-disable-devices-for-RHEL.patch

@@ -1,7 +1,7 @@
-From 2a8663a185aaafacac2414477c70d749be211d8e Mon Sep 17 00:00:00 2001
+From ebbe3b0dc13b2f8ee7a1fcf9f6e687637a59ea35 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
-Subject: [PATCH] Enable/disable devices for RHEL
+Subject: Enable/disable devices for RHEL
 
 This commit adds all changes related to changes in supported devices.
 
@@ -66,6 +66,7 @@ Merged patches (7.1.0):
 Merged patches (8.1.0):
 - 8173d2eaba Disable unwanted new devices
 ---
+ .distro/qemu-kvm.spec.template                |  18 +--
  .../aarch64-softmmu/aarch64-rh-devices.mak    |  41 +++++++
  .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
  configs/devices/rh-virtio.mak                 |  10 ++
@@ -93,7 +94,7 @@ Merged patches (8.1.0):
  target/s390x/cpu_models_sysemu.c              |   3 +
  target/s390x/kvm/kvm.c                        |   8 ++
  tests/qtest/arm-cpu-features.c                |   4 +
- 27 files changed, 311 insertions(+), 5 deletions(-)
+ 28 files changed, 321 insertions(+), 13 deletions(-)
  create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
  create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
  create mode 100644 configs/devices/rh-virtio.mak
@@ -888,3 +889,6 @@ index 3fc33fc24d..e5e4007e9f 100644
  
          sve_tests_default(qts, "max");
          pauth_tests_default(qts, "max");
+-- 
+2.39.3
+

0006-Machine-type-related-general-changes.patch

@@ -1,7 +1,7 @@
-From b4a38f074c6bcbb3e68177fe97f955a447864748 Mon Sep 17 00:00:00 2001
+From 145fbe0a1526bb68a7bd7acaf5b41539faf5f04a Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
-Subject: [PATCH] Machine type related general changes
+Subject: Machine type related general changes
 
 This patch is first part of original "Add RHEL machine types" patch we
 split to allow easier review. It contains changes not related to any
@@ -680,3 +680,6 @@ index d54e8b1101..ae0f49b93c 100644
  
      /* RAM / address space compat: */
      bool gigabyte_align;
+-- 
+2.39.3
+

0007-Add-aarch64-machine-types.patch

@@ -1,11 +1,66 @@
-From d5545d5287f04b69a052fa55c66d5ced5aa7b40e Mon Sep 17 00:00:00 2001
+From f68fb44c79615701195203b2548135579b1fd596 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
-Subject: [PATCH] Add aarch64 machine types
+Subject: Add aarch64 machine types
 
 Adding changes to add RHEL machine types for aarch64 architecture.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+Rebase notes (6.1.0):
+- Use CONFIG_TPM check when using TPM structures
+- Add support for default_bus_bypass_iommu
+- ea4c0b32d9 arm/virt: Register highmem and gic-version as class properties
+- 895e1fa86a hw/arm/virt: Add 8.5 and 9.0 machine types and remove older ones
+
+Rebase notes (7.0.0):
+- Added dtb-kaslr-seed option
+- Set no_tcg_lpa2 to true
+
+Rebase notes (7.1.0):
+- replace dtb_kaslr_seed by dtb_randomness
+- Updated dtb_randomness comment
+
+Rebase notes (7.2.0):
+- Disabled cortex-a35
+
+Rebase notes (8.0.0):
+- Moved changed code from target/arm/helper.c to target/arm/arm-qmp-cmds.c
+
+Rebase notes (8.1.0):
+- Added setting default_nic
+
+Merged patches (6.2.0):
+- 9a3d4fde0e hw/arm/virt: Remove 9.0 machine type
+- f7d04d6695 hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
+
+Merged patches (7.0.0):
+- 3b82be3dd3 redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
+- c354a86c9b hw/arm/virt: Register "iommu" as a class property
+- c1a2630dc9 hw/arm/virt: Register "its" as a class property
+- 9d8c61dc93 hw/arm/virt: Rename default_bus_bypass_iommu
+- a1d1b6eeb6 hw/arm/virt: Expose the 'RAS' option
+- 47f8fe1b82 hw/arm/virt: Add 9.0 machine type and remove 8.5 one
+- ed2346788f hw/arm/virt: Check no_tcg_its and minor style changes
+
+Merged patches (7.0.0):
+- f79b31bdef hw/arm/virt: Remove the dtb-kaslr-seed machine option
+- b6fca85f4a hw/arm/virt: Fix missing initialization in instance/class_init()
+
+Merged patches (7.1.0):
+- ac97dd4f9f RHEL-only: AArch64: Drop unsupported CPU types
+- e9c0a70664 target/arm: deprecate named CPU models
+
+Merged patches (7.2.0):
+- 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
+
+Merged patches (8.0.0):
+- c1a21266d8 redhat: aarch64: add rhel9.2.0 virt machine type
+- d97cd7c513 redhat: fix virt-rhel9.2.0 compat props
+
+Merged patches (8.1.0):
+- bd5d81d286 Add RHEL 9.2.0 compat structure (arm part)
+- c07f666086 hw/arm/virt: Validate cluster and NUMA node boundary for RHEL machines
 ---
  hw/arm/virt.c         | 248 +++++++++++++++++++++++++++++++++++++++++-
  include/hw/arm/virt.h |   8 ++
@@ -367,3 +422,6 @@ index e1ddbea96b..81c2363a40 100644
  void virt_acpi_setup(VirtMachineState *vms);
  bool virt_is_acpi_enabled(VirtMachineState *vms);
  
+-- 
+2.39.3
+

0008-Add-ppc64-machine-types.patch

@@ -1,7 +1,7 @@
-From 720842119b771090a08520e51f1772f234e1ee90 Mon Sep 17 00:00:00 2001
+From bfe11e8d63f27ebc5bba4ca915e6e641af3a340b Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
-Subject: [PATCH] Add ppc64 machine types
+Subject: Add ppc64 machine types
 
 Adding changes to add RHEL machine types for ppc64 architecture.
 
@@ -539,3 +539,6 @@ index 6a4dd9c560..e0cd6fb1c7 100644
  static inline int kvmppc_enable_hwrng(void)
  {
      return -1;
+-- 
+2.39.3
+

0009-Add-s390x-machine-types.patch

@@ -1,7 +1,7 @@
-From e30201e9f63350f9e7c44dd754942fe9e8dca785 Mon Sep 17 00:00:00 2001
+From a3b5d9d0d0b59de4956ad88e5e855fe1a56ae215 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
-Subject: [PATCH] Add s390x machine types
+Subject: Add s390x machine types
 
 Adding changes to add RHEL machine types for s390x architecture.
 
@@ -285,3 +285,6 @@ index 87a4480c05..28c1b0486c 100644
      /* check for unavailable features */
      if (cpu_list_data->model) {
          Object *obj;
+-- 
+2.39.3
+

0010-Add-x86_64-machine-types.patch

@@ -1,7 +1,7 @@
-From 9bf78f1c31c8c06d957b2551dabd1150c0d42bfb Mon Sep 17 00:00:00 2001
+From 70b66fab556a893f7f8b328f92bcd94c9b2978dd Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
-Subject: [PATCH] Add x86_64 machine types
+Subject: Add x86_64 machine types
 
 Adding changes to add RHEL machine types for x86_64 architecture.
 
@@ -66,7 +66,7 @@ Merged patches (8.1.0):
  9 files changed, 557 insertions(+), 7 deletions(-)
 
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 3109d5e0e0..8ff45cde20 100644
+index 3109d5e0e0..4be9a7db82 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
 @@ -410,6 +410,155 @@ GlobalProperty pc_compat_1_4[] = {
@@ -88,7 +88,7 @@ index 3109d5e0e0..8ff45cde20 100644
 +    { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
 +    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
 +    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
-+    /* bz 1508330 */
++    /* bz 1508330 */ 
 +    { "vfio-pci", "x-no-geforce-quirks", "on" },
 +    /* bz 1941397 */
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
@@ -191,27 +191,27 @@ index 3109d5e0e0..8ff45cde20 100644
 + * machine types irrespective of host.
 + */
 +GlobalProperty pc_rhel_7_6_compat[] = {
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */
++    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
 +    { TYPE_X86_CPU, "x-hv-synic-kvm-only", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */
++    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "pku", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */
++    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "pku", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { TYPE_X86_CPU, "x-migrate-smi-count", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { "Skylake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { "Skylake-Client-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { "Icelake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */
++    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
 +    { "Icelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +};
 +const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
@@ -907,3 +907,6 @@ index 78f1cf8186..ac954c9b06 100644
  
      val = qtest_inb(qts, 0x505);
      g_assert_cmpuint(val, ==, 3);
+-- 
+2.39.3
+

0011-Enable-make-check.patch

@@ -1,13 +1,50 @@
-From a869d740b1219361566895ea4429e2d78dfccfa8 Mon Sep 17 00:00:00 2001
+From 301a52cd6a94e98e69b8beac2810e76f1cc47073 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
-Subject: [PATCH] Enable make check
+Subject: Enable make check
 
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
+Rebase changes (6.1.0):
+- removed unnecessary test changes
+
+Rebase changes (6.2.0):
+- new way of disabling bios-table-test
+
+Rebase changes (7.0.0):
+- Disable testing virtio-iommu-pci
+- Rename default_bus_bypass_iommu property to default-bus-bypass-iommu
+- Disable qtest-bios-table for aarch64
+- Removed redhat chunks for boot-serial-test.c, cdrom-test.c and cpu-plug-test.c qtests
+- Do not disable boot-order-test, prom-env-test and boot-serial-test qtests
+- Use rhel machine type for new intel hda qtest
+- Remove unnecessary changes in iotest 051
+- Remove changes in bios-tables-test.c and prom-env-test.c qtests
+
+Rebase changes (7.1.0):
+- Disable bcm2835-dma-test (added upstream)
+
+Rebase changes (8.0.0):
+- Removed chunks for disabling bios-table-test (protected upstream)
+- Disable new qemu-iotests execution
+- Revert change in tco qtest (blocking test run)
+
+Rebase changes (8.1.0):
+- Do not disable device-plug-test for s390x
+
+Merged patches (6.1.0):
+- 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
+
+Merged patches (7.1.0):
+- 64d736640e RHEL-only: tests/avocado: Switch aarch64 tests from a53 to a57
+
+Merged patches (8.1.0):
+- f468163234 iotests: Use alternative CPU type that is not deprecated in RHEL
+---
+ .distro/qemu-kvm.spec.template      |  4 ++--
  tests/avocado/replay_kernel.py      |  2 +-
  tests/avocado/reverse_debugging.py  |  2 +-
  tests/avocado/tcg_plugins.py        |  6 ++---
@@ -22,7 +59,7 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  tests/qtest/tco-test.c              |  2 +-
  tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
  tests/qtest/virtio-net-failover.c   |  1 +
- 14 files changed, 36 insertions(+), 29 deletions(-)
+ 15 files changed, 38 insertions(+), 31 deletions(-)
 
 diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
 index 79c607b0e7..c8827624f8 100644
@@ -270,3 +307,6 @@ index 4a809590bf..1bf3fa641c 100644
      "-device pcie-root-port,id=root0,addr=0x1,bus=pcie.0,chassis=1 " \
      "-device pcie-root-port,id=root1,addr=0x2,bus=pcie.0,chassis=2 "
  
+-- 
+2.39.3
+

0012-vfio-cap-number-of-devices-that-can-be-assigned.patch

@@ -1,7 +1,7 @@
-From 2198cdd64f9317094a47fa7418e8aac28ab5466e Mon Sep 17 00:00:00 2001
+From 6e5c0cde105d9250a6c46c06e44c4066cb804bf4 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
-Subject: [PATCH] vfio: cap number of devices that can be assigned
+Subject: vfio: cap number of devices that can be assigned
 
 RH-Author: Bandan Das <bsd@redhat.com>
 Message-id: <1386101113-31560-3-git-send-email-bsd@redhat.com>
@@ -101,3 +101,6 @@ index a2771b9ff3..a69af7bdde 100644
      uint32_t vendor_id;
      uint32_t device_id;
      uint32_t sub_vendor_id;
+-- 
+2.39.3
+

0013-Add-support-statement-to-help-output.patch

@@ -1,7 +1,7 @@
-From 2be126e8077c079a3fad745384e205dcaf091082 Mon Sep 17 00:00:00 2001
+From b6d7732d3fb071c96a86d8e98d8ef9f73932deaf Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
-Subject: [PATCH] Add support statement to -help output
+Subject: Add support statement to -help output
 
 RH-Author: Eduardo Habkost <ehabkost@redhat.com>
 Message-id: <1386183197-27761-1-git-send-email-ehabkost@redhat.com>
@@ -50,3 +50,6 @@ index b0b96f67fa..e24c74771b 100644
      exit(exitcode);
  }
  
+-- 
+2.39.3
+

0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch

@@ -1,7 +1,7 @@
-From f8bd6fa0cc6f2d8517b9333f5b4f0b5ee47c30c0 Mon Sep 17 00:00:00 2001
+From 9f13719399c2b07b3fe8d691134363075ccd8a32 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
-Subject: [PATCH] Use qemu-kvm in documentation instead of qemu-system-<arch>
+Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
@@ -56,3 +56,6 @@ index 29b98c3d4c..75a6396ed6 100644
  
  ``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
      Establish a vhost-vdpa netdev.
+-- 
+2.39.3
+

0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch

@@ -1,7 +1,7 @@
-From 9e16cb3d2facc8fb20d502d1c94547141555cb32 Mon Sep 17 00:00:00 2001
+From 28f0f014754e68ca5e5e00ba0dfbb38e3f60e77b Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
-Subject: [PATCH] qcow2: Deprecation warning when opening v2 images rw
+Subject: qcow2: Deprecation warning when opening v2 images rw
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -33,6 +33,11 @@ uses it this way for another warning.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 
 patch_name: kvm-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+present_in_specfile: true
+location_in_specfile: 116
+---
+Rebase notes (6.1.0):
+- Replace bs->read_only with bdrv_is_read_only
 ---
  block/qcow2.c                    | 6 ++++++
  tests/qemu-iotests/common.filter | 1 +
@@ -67,3 +72,6 @@ index fc3c64bcb8..4b238954d5 100644
          -e $'s#\r##' # QEMU monitor uses \r\n line endings
  }
  
+-- 
+2.39.3
+

0016-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch

@@ -1,7 +1,7 @@
-From 6048ff87666e1c1f023b6c39b25e26e878f79869 Mon Sep 17 00:00:00 2001
+From 1b07788415a3d9729a3b11fc14d1d56ce5e6c888 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Thu, 10 Aug 2023 16:08:18 +0200
-Subject: [PATCH] vdpa: use first queue SVQ state for CVQ default
+Subject: vdpa: use first queue SVQ state for CVQ default
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -26,6 +26,8 @@ Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 
 Patch-name: kvm-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch
+Patch-id: 189
+Patch-present-in-specfile: True
 ---
  net/vhost-vdpa.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
@@ -43,3 +45,6 @@ index 9795306742..a772540250 100644
      s->vhost_vdpa.address_space_id = VHOST_VDPA_GUEST_PA_ASID;
  
      if (s->vhost_vdpa.shadow_data) {
+-- 
+2.39.3
+

0017-vdpa-export-vhost_vdpa_set_vring_ready.patch

@@ -1,7 +1,7 @@
-From 83f01998db0d32a738a0f0beb4480d762fa6e025 Mon Sep 17 00:00:00 2001
+From 90235be168d252feb40376ea5a3cc67fcfe097af Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Wed, 25 Jan 2023 08:47:34 +0100
-Subject: [PATCH] vdpa: export vhost_vdpa_set_vring_ready
+Subject: vdpa: export vhost_vdpa_set_vring_ready
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -27,6 +27,8 @@ Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 
 Patch-name: kvm-vdpa-export-vhost_vdpa_set_vring_ready.patch
+Patch-id: 190
+Patch-present-in-specfile: True
 ---
  hw/virtio/trace-events         |  2 +-
  hw/virtio/vhost-vdpa.c         | 25 +++++++++++++------------
@@ -102,3 +104,6 @@ index e64bfc7f98..5407d54fd7 100644
  
  int vhost_vdpa_dma_map(struct vhost_vdpa *v, uint32_t asid, hwaddr iova,
                         hwaddr size, void *vaddr, bool readonly);
+-- 
+2.39.3
+

0018-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch

@@ -1,7 +1,7 @@
-From 91076a2975ed193b277c9b96f76ed1f86242c9ed Mon Sep 17 00:00:00 2001
+From 772d982f7aa1101dcd873b2f7d800d9f841d3171 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Wed, 9 Aug 2023 18:07:26 +0200
-Subject: [PATCH] vdpa: rename vhost_vdpa_net_load to vhost_vdpa_net_cvq_load
+Subject: vdpa: rename vhost_vdpa_net_load to vhost_vdpa_net_cvq_load
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -19,6 +19,8 @@ Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 
 Patch-name: kvm-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch
+Patch-id: 191
+Patch-present-in-specfile: True
 ---
  net/vhost-vdpa.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
@@ -45,3 +47,6 @@ index a772540250..9251351b4b 100644
      .stop = vhost_vdpa_net_cvq_stop,
      .cleanup = vhost_vdpa_cleanup,
      .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
+-- 
+2.39.3
+

0019-vdpa-move-vhost_vdpa_set_vring_ready-to-the-caller.patch

@@ -1,7 +1,7 @@
-From 11412870b7bfb3ebb63136f4cc409afb0760f08b Mon Sep 17 00:00:00 2001
+From aa519f65c777fd7dbb1236a4f4db73f90e51660c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Thu, 10 Aug 2023 11:27:28 +0200
-Subject: [PATCH] vdpa: move vhost_vdpa_set_vring_ready to the caller
+Subject: vdpa: move vhost_vdpa_set_vring_ready to the caller
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -23,6 +23,9 @@ the function is already static so it would only add an empty
 vhost_vdpa_net_data_load stub.
 
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
+---
+Rebase notes (8.1.0):
+- Moved additional upstream calls to conditional block
 ---
  hw/virtio/vdpa-dev.c   |  3 +++
  hw/virtio/vhost-vdpa.c |  3 ---
@@ -141,3 +144,6 @@ index 9251351b4b..3bf60f9431 100644
      }
  
      return 0;
+-- 
+2.39.3
+

0020-vdpa-remove-net-cvq-migration-blocker.patch

@@ -1,7 +1,7 @@
-From d6da22076b3f59c2a0f664da93fc838e4270f9fe Mon Sep 17 00:00:00 2001
+From aab6b27d559afb03cac1e9f873a65abc540b04c8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Fri, 24 Mar 2023 13:28:15 +0100
-Subject: [PATCH] vdpa: remove net cvq migration blocker
+Subject: vdpa: remove net cvq migration blocker
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -21,6 +21,8 @@ Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 
 Patch-name: kvm-vdpa-remove-net-cvq-migration-blocker.patch
+Patch-id: 193
+Patch-present-in-specfile: True
 ---
  net/vhost-vdpa.c | 12 ------------
  1 file changed, 12 deletions(-)
@@ -48,3 +50,6 @@ index 3bf60f9431..6bb56f7d94 100644
      }
      ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
      if (ret) {
+-- 
+2.39.3
+

0021-Add-machine-types-compat-bits.patch

@@ -1,7 +1,7 @@
-From 00d4a5989a5f8437ccbb4a6d1ef186cb6cbe05aa Mon Sep 17 00:00:00 2001
+From 4ee284aca9a6fb151f85f266b375a8c1d9213a28 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 28 Jun 2023 01:40:03 -0400
-Subject: [PATCH] Add machine types compat bits.
+Subject: Add machine types compat bits.
 
 Adding upstream compat changes to rhel machine types.
 
@@ -49,7 +49,7 @@ index 2e54c7ae7c..8e23b9263d 100644
    /* hw_compat_rhel_9_2 from hw_compat_7_2 */
    { "e1000e", "migrate-timadj", "off" },
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 8ff45cde20..ea7cf2fa15 100644
+index 4be9a7db82..173815cc7e 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
 @@ -432,6 +432,12 @@ GlobalProperty pc_rhel_compat[] = {
@@ -135,3 +135,6 @@ index 7b569fa254..eb6ff6b099 100644
  extern GlobalProperty pc_rhel_9_2_compat[];
  extern const size_t pc_rhel_9_2_compat_len;
  
+-- 
+2.39.3
+

0022-Fix-x86-machine-type-compatibility-for-qemu-kvm-8.1..patch

@@ -1,7 +1,7 @@
-From 6a2356f6102cd8757744349911ada90c015a56b1 Mon Sep 17 00:00:00 2001
+From 719e2ac147c64d3caa1b86fb94a4182e9ff43f1b Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Tue, 22 Aug 2023 14:36:29 +0200
-Subject: [PATCH] Fix x86 machine type compatibility for qemu-kvm 8.1.0
+Subject: Fix x86 machine type compatibility for qemu-kvm 8.1.0
 
 Jira: https://issues.redhat.com/browse/RHEL-874
 Upstream Status: RHEL-only
@@ -56,3 +56,6 @@ index 0b8adb0adb..a205226381 100644
                       pc_rhel_9_3_compat_len);
      compat_props_add(m->compat_props, hw_compat_rhel_9_2,
                       hw_compat_rhel_9_2_len);
+-- 
+2.39.3
+

kvm-file-posix-Check-bs-bl.zoned-for-zone-info.patch

@@ -0,0 +1,73 @@
+From 42dac3d063e0f44e92211a4fbdaf1f0d64843562 Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Thu, 24 Aug 2023 17:53:41 +0200
+Subject: [PATCH 10/13] file-posix: Check bs->bl.zoned for zone info
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
+RH-Jira: RHEL-7360
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/5] d853b88d6b71b6f4fe1bb70ae2e3b6108cbdb8dc (hreitz/qemu-kvm-c-9-s)
+
+Instead of checking bs->wps or bs->bl.zone_size for whether zone
+information is present, check bs->bl.zoned.  That is the flag that
+raw_refresh_zoned_limits() reliably sets to indicate zone support.  If
+it is set to something other than BLK_Z_NONE, other values and objects
+like bs->wps and bs->bl.zone_size must be non-null/zero and valid; if it
+is not, we cannot rely on their validity.
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230824155345.109765-3-hreitz@redhat.com>
+Reviewed-by: Sam Li <faithilikerun@gmail.com>
+(cherry picked from commit 4b5d80f3d02096a9bb1f651f6b3401ba40877159)
+
+Downstream: Fixed typo in the last hunk ("bs->blk" changed to
+            "bs->blk").  This code is removed in the commit after the
+            next, still, should be fixed now that I noticed.
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/file-posix.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/block/file-posix.c b/block/file-posix.c
+index 2b88b9eefa..9f14850e24 100644
+--- a/block/file-posix.c
++++ b/block/file-posix.c
+@@ -2455,9 +2455,10 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
+     if (fd_open(bs) < 0)
+         return -EIO;
+ #if defined(CONFIG_BLKZONED)
+-    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) && bs->wps) {
++    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
++        bs->bl.zoned != BLK_Z_NONE) {
+         qemu_co_mutex_lock(&bs->wps->colock);
+-        if (type & QEMU_AIO_ZONE_APPEND && bs->bl.zone_size) {
++        if (type & QEMU_AIO_ZONE_APPEND) {
+             int index = offset / bs->bl.zone_size;
+             offset = bs->wps->wp[index];
+         }
+@@ -2508,8 +2509,8 @@ out:
+ {
+     BlockZoneWps *wps = bs->wps;
+     if (ret == 0) {
+-        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND))
+-            && wps && bs->bl.zone_size) {
++        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
++            bs->bl.zoned != BLK_Z_NONE) {
+             uint64_t *wp = &wps->wp[offset / bs->bl.zone_size];
+             if (!BDRV_ZT_IS_CONV(*wp)) {
+                 if (type & QEMU_AIO_ZONE_APPEND) {
+@@ -2529,7 +2530,8 @@ out:
+         }
+     }
+ 
+-    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) && wps) {
++    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
++        bs->bl.zoned != BLK_Z_NONE) {
+         qemu_co_mutex_unlock(&wps->colock);
+     }
+ }
+-- 
+2.39.3
+

kvm-file-posix-Clear-bs-bl.zoned-on-error.patch

@@ -0,0 +1,96 @@
+From 1eba7b686a41c71f24f60f8adcd51ddf1882686d Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Thu, 24 Aug 2023 17:53:40 +0200
+Subject: [PATCH 09/13] file-posix: Clear bs->bl.zoned on error
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
+RH-Jira: RHEL-7360
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/5] 3e2419b64b35afdfa45f70c5eb61478321de5233 (hreitz/qemu-kvm-c-9-s)
+
+bs->bl.zoned is what indicates whether the zone information is present
+and valid; it is the only thing that raw_refresh_zoned_limits() sets if
+CONFIG_BLKZONED is not defined, and it is also the only thing that it
+sets if CONFIG_BLKZONED is defined, but there are no zones.
+
+Make sure that it is always set to BLK_Z_NONE if there is an error
+anywhere in raw_refresh_zoned_limits() so that we do not accidentally
+announce zones while our information is incomplete or invalid.
+
+This also fixes a memory leak in the last error path in
+raw_refresh_zoned_limits().
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230824155345.109765-2-hreitz@redhat.com>
+Reviewed-by: Sam Li <faithilikerun@gmail.com>
+(cherry picked from commit 56d1a022a77ea2125564913665eeadf3e303a671)
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/file-posix.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/block/file-posix.c b/block/file-posix.c
+index b16e9c21a1..2b88b9eefa 100644
+--- a/block/file-posix.c
++++ b/block/file-posix.c
+@@ -1412,11 +1412,9 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
+     BlockZoneModel zoned;
+     int ret;
+ 
+-    bs->bl.zoned = BLK_Z_NONE;
+-
+     ret = get_sysfs_zoned_model(st, &zoned);
+     if (ret < 0 || zoned == BLK_Z_NONE) {
+-        return;
++        goto no_zoned;
+     }
+     bs->bl.zoned = zoned;
+ 
+@@ -1437,10 +1435,10 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
+     if (ret < 0) {
+         error_setg_errno(errp, -ret, "Unable to read chunk_sectors "
+                                      "sysfs attribute");
+-        return;
++        goto no_zoned;
+     } else if (!ret) {
+         error_setg(errp, "Read 0 from chunk_sectors sysfs attribute");
+-        return;
++        goto no_zoned;
+     }
+     bs->bl.zone_size = ret << BDRV_SECTOR_BITS;
+ 
+@@ -1448,10 +1446,10 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
+     if (ret < 0) {
+         error_setg_errno(errp, -ret, "Unable to read nr_zones "
+                                      "sysfs attribute");
+-        return;
++        goto no_zoned;
+     } else if (!ret) {
+         error_setg(errp, "Read 0 from nr_zones sysfs attribute");
+-        return;
++        goto no_zoned;
+     }
+     bs->bl.nr_zones = ret;
+ 
+@@ -1472,10 +1470,15 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
+     ret = get_zones_wp(bs, s->fd, 0, bs->bl.nr_zones, 0);
+     if (ret < 0) {
+         error_setg_errno(errp, -ret, "report wps failed");
+-        bs->wps = NULL;
+-        return;
++        goto no_zoned;
+     }
+     qemu_co_mutex_init(&bs->wps->colock);
++    return;
++
++no_zoned:
++    bs->bl.zoned = BLK_Z_NONE;
++    g_free(bs->wps);
++    bs->wps = NULL;
+ }
+ #else /* !defined(CONFIG_BLKZONED) */
+ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
+-- 
+2.39.3
+

kvm-file-posix-Fix-zone-update-in-I-O-error-path.patch

@@ -0,0 +1,42 @@
+From fc9ca44d7df182a0a483d8376054850ba46e633d Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Thu, 24 Aug 2023 17:53:42 +0200
+Subject: [PATCH 11/13] file-posix: Fix zone update in I/O error path
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
+RH-Jira: RHEL-7360
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [3/5] 28a8540b2ac0c437f8afb90fd5566fc83bfcfdc4 (hreitz/qemu-kvm-c-9-s)
+
+We must check that zone information is present before running
+update_zones_wp().
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2234374
+Fixes: Coverity CID 1512459
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230824155345.109765-4-hreitz@redhat.com>
+Reviewed-by: Sam Li <faithilikerun@gmail.com>
+(cherry picked from commit deab5c9a4ed74f76a713008a42527762b30a7e84)
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/file-posix.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/file-posix.c b/block/file-posix.c
+index 9f14850e24..b9d5e4741b 100644
+--- a/block/file-posix.c
++++ b/block/file-posix.c
+@@ -2525,7 +2525,8 @@ out:
+             }
+         }
+     } else {
+-        if (type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) {
++        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
++            bs->bl.zoned != BLK_Z_NONE) {
+             update_zones_wp(bs, s->fd, 0, 1);
+         }
+     }
+-- 
+2.39.3
+

kvm-file-posix-Simplify-raw_co_prw-s-out-zone-code.patch

@@ -0,0 +1,71 @@
+From fbf511a9f7272815fc6d7414735049689186c750 Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Thu, 24 Aug 2023 17:53:43 +0200
+Subject: [PATCH 12/13] file-posix: Simplify raw_co_prw's 'out' zone code
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
+RH-Jira: RHEL-7360
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [4/5] c0b37cc9ff308de300e45d1a10942d11fbabea26 (hreitz/qemu-kvm-c-9-s)
+
+We duplicate the same condition three times here, pull it out to the top
+level.
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230824155345.109765-5-hreitz@redhat.com>
+Reviewed-by: Sam Li <faithilikerun@gmail.com>
+(cherry picked from commit d31b50a15dd25a560749b25fc40b6484fd1a57b7)
+
+Downstream conflict with the downstream change in HEAD^^ (conflicting
+code is removed).
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/file-posix.c | 18 +++++-------------
+ 1 file changed, 5 insertions(+), 13 deletions(-)
+
+diff --git a/block/file-posix.c b/block/file-posix.c
+index b9d5e4741b..aa89789737 100644
+--- a/block/file-posix.c
++++ b/block/file-posix.c
+@@ -2506,11 +2506,10 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
+ 
+ out:
+ #if defined(CONFIG_BLKZONED)
+-{
+-    BlockZoneWps *wps = bs->wps;
+-    if (ret == 0) {
+-        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
+-            bs->bl.zoned != BLK_Z_NONE) {
++    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
++        bs->bl.zoned != BLK_Z_NONE) {
++        BlockZoneWps *wps = bs->wps;
++        if (ret == 0) {
+             uint64_t *wp = &wps->wp[offset / bs->bl.zone_size];
+             if (!BDRV_ZT_IS_CONV(*wp)) {
+                 if (type & QEMU_AIO_ZONE_APPEND) {
+@@ -2523,19 +2522,12 @@ out:
+                     *wp = offset + bytes;
+                 }
+             }
+-        }
+-    } else {
+-        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
+-            bs->bl.zoned != BLK_Z_NONE) {
++        } else {
+             update_zones_wp(bs, s->fd, 0, 1);
+         }
+-    }
+ 
+-    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
+-        bs->bl.zoned != BLK_Z_NONE) {
+         qemu_co_mutex_unlock(&wps->colock);
+     }
+-}
+ #endif
+     return ret;
+ }
+-- 
+2.39.3
+

kvm-fix-clang17-s390x.patch

@@ -0,0 +1,57 @@
+From 90733c05b4fe0c55b6427a812ca262d7121fbaa4 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Thu, 19 Oct 2023 02:55:22 -0400
+Subject: [PATCH] Fix build s390x build issue with Clang 17
+
+When using Clang 17, s390x build fails due to unaligned variables.
+This is fix for the issue.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ host/include/generic/host/atomic128-cas.h  | 2 +-
+ host/include/generic/host/atomic128-ldst.h | 2 +-
+ include/qemu/int128.h                      | 1 +
+ 3 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/host/include/generic/host/atomic128-cas.h b/host/include/generic/host/atomic128-cas.h
+index 991d3da082..6b40cc2271 100644
+--- a/host/include/generic/host/atomic128-cas.h
++++ b/host/include/generic/host/atomic128-cas.h
+@@ -28,7 +28,7 @@ atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
+ static inline Int128 ATTRIBUTE_ATOMIC128_OPT
+ atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
+ {
+-    __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
++    Int128Aligned *ptr_align = __builtin_assume_aligned(ptr, 16);
+     Int128Alias r, c, n;
+
+     c.s = cmp;
+diff --git a/host/include/generic/host/atomic128-ldst.h b/host/include/generic/host/atomic128-ldst.h
+index 80fff0643a..691e6a8531 100644
+--- a/host/include/generic/host/atomic128-ldst.h
++++ b/host/include/generic/host/atomic128-ldst.h
+@@ -58,7 +58,7 @@ atomic16_read_rw(Int128 *ptr)
+ static inline void ATTRIBUTE_ATOMIC128_OPT
+ atomic16_set(Int128 *ptr, Int128 val)
+ {
+-    __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
++    Int128Aligned *ptr_align = __builtin_assume_aligned(ptr, 16);
+     __int128_t old;
+     Int128Alias new;
+
+diff --git a/include/qemu/int128.h b/include/qemu/int128.h
+index 73624e8be7..44530d3e10 100644
+--- a/include/qemu/int128.h
++++ b/include/qemu/int128.h
+@@ -10,6 +10,7 @@
+  */
+ #if defined(CONFIG_INT128) && !defined(CONFIG_TCG_INTERPRETER)
+ typedef __int128_t Int128;
++typedef __int128_t __attribute__((aligned(16))) Int128Aligned;
+
+ static inline Int128 int128_make64(uint64_t a)
+ {
+-- 
+2.39.3
+

kvm-migration-Consolidate-return-path-closing-code.patch

@@ -0,0 +1,86 @@
+From 33f0f63da753fff2a3d2bf14542abe0665878e3d Mon Sep 17 00:00:00 2001
+From: Fabiano Rosas <farosas@suse.de>
+Date: Mon, 18 Sep 2023 14:28:20 -0300
+Subject: [PATCH 06/13] migration: Consolidate return path closing code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [6/8] d3a4e08e1f1afe92afac12a3404a84d1c23e0f02 (peterx/qemu-kvm)
+
+We'll start calling the await_return_path_close_on_source() function
+from other parts of the code, so move all of the related checks and
+tracepoints into it.
+
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-7-farosas@suse.de>
+(cherry picked from commit d50f5dc075cbb891bfe4a9378600a4871264468a)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c | 29 ++++++++++++++---------------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index e2e4a7d8ae..ac4541b971 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -2050,6 +2050,14 @@ static int open_return_path_on_source(MigrationState *ms,
+ /* Returns 0 if the RP was ok, otherwise there was an error on the RP */
+ static int await_return_path_close_on_source(MigrationState *ms)
+ {
++    int ret;
++
++    if (!ms->rp_state.rp_thread_created) {
++        return 0;
++    }
++
++    trace_migration_return_path_end_before();
++
+     /*
+      * If this is a normal exit then the destination will send a SHUT
+      * and the rp_thread will exit, however if there's an error we
+@@ -2067,7 +2075,10 @@ static int await_return_path_close_on_source(MigrationState *ms)
+     qemu_thread_join(&ms->rp_state.rp_thread);
+     ms->rp_state.rp_thread_created = false;
+     trace_await_return_path_close_on_source_close();
+-    return ms->rp_state.error;
++
++    ret = ms->rp_state.error;
++    trace_migration_return_path_end_after(ret);
++    return ret;
+ }
+ 
+ static inline void
+@@ -2363,20 +2374,8 @@ static void migration_completion(MigrationState *s)
+         goto fail;
+     }
+ 
+-    /*
+-     * If rp was opened we must clean up the thread before
+-     * cleaning everything else up (since if there are no failures
+-     * it will wait for the destination to send it's status in
+-     * a SHUT command).
+-     */
+-    if (s->rp_state.rp_thread_created) {
+-        int rp_error;
+-        trace_migration_return_path_end_before();
+-        rp_error = await_return_path_close_on_source(s);
+-        trace_migration_return_path_end_after(rp_error);
+-        if (rp_error) {
+-            goto fail;
+-        }
++    if (await_return_path_close_on_source(s)) {
++        goto fail;
+     }
+ 
+     if (qemu_file_get_error(s->to_dst_file)) {
+-- 
+2.39.3
+

kvm-migration-Fix-possible-race-when-setting-rp_state.er.patch

@@ -0,0 +1,48 @@
+From 93aa615c5e8de7422d7162a0731739b2bd82a582 Mon Sep 17 00:00:00 2001
+From: Fabiano Rosas <farosas@suse.de>
+Date: Mon, 18 Sep 2023 14:28:16 -0300
+Subject: [PATCH 02/13] migration: Fix possible race when setting
+ rp_state.error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [2/8] 97305847fc18b6b18cb6f3ff32c82918c2562664 (peterx/qemu-kvm)
+
+We don't need to set the rp_state.error right after a shutdown because
+qemu_file_shutdown() always sets the QEMUFile error, so the return
+path thread would have seen it and set the rp error itself.
+
+Setting the error outside of the thread is also racy because the
+thread could clear it after we set it.
+
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-3-farosas@suse.de>
+(cherry picked from commit 28a8347281e24c2e7bba6d3301472eda41d4c096)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index 6a7122694a..b92c6ae436 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -2063,7 +2063,6 @@ static int await_return_path_close_on_source(MigrationState *ms)
+          * waiting for the destination.
+          */
+         qemu_file_shutdown(ms->rp_state.from_dst_file);
+-        mark_source_rp_bad(ms);
+     }
+     trace_await_return_path_close_on_source_joining();
+     qemu_thread_join(&ms->rp_state.rp_thread);
+-- 
+2.39.3
+

kvm-migration-Fix-possible-race-when-shutting-down-to_ds.patch

@@ -0,0 +1,82 @@
+From 52e2456a41678f29a67e4b7cd4d7ee20e5298bc0 Mon Sep 17 00:00:00 2001
+From: Fabiano Rosas <farosas@suse.de>
+Date: Mon, 18 Sep 2023 14:28:18 -0300
+Subject: [PATCH 04/13] migration: Fix possible race when shutting down
+ to_dst_file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [4/8] 99b9ce27c4477b9630cedfb02a534f8c490ab1eb (peterx/qemu-kvm)
+
+It's not safe to call qemu_file_shutdown() on the to_dst_file without
+first checking for the file's presence under the lock. The cleanup of
+this file happens at postcopy_pause() and migrate_fd_cleanup() which
+are not necessarily running in the same thread as migrate_fd_cancel().
+
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-5-farosas@suse.de>
+(cherry picked from commit 7478fb0df914f0a5ab551ff74b1df62dd250500e)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index 517b3e04d2..169e6bdce8 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -1246,7 +1246,7 @@ static void migrate_fd_error(MigrationState *s, const Error *error)
+ static void migrate_fd_cancel(MigrationState *s)
+ {
+     int old_state ;
+-    QEMUFile *f = migrate_get_current()->to_dst_file;
++
+     trace_migrate_fd_cancel();
+ 
+     WITH_QEMU_LOCK_GUARD(&s->qemu_file_lock) {
+@@ -1272,11 +1272,13 @@ static void migrate_fd_cancel(MigrationState *s)
+      * If we're unlucky the migration code might be stuck somewhere in a
+      * send/write while the network has failed and is waiting to timeout;
+      * if we've got shutdown(2) available then we can force it to quit.
+-     * The outgoing qemu file gets closed in migrate_fd_cleanup that is
+-     * called in a bh, so there is no race against this cancel.
+      */
+-    if (s->state == MIGRATION_STATUS_CANCELLING && f) {
+-        qemu_file_shutdown(f);
++    if (s->state == MIGRATION_STATUS_CANCELLING) {
++        WITH_QEMU_LOCK_GUARD(&s->qemu_file_lock) {
++            if (s->to_dst_file) {
++                qemu_file_shutdown(s->to_dst_file);
++            }
++        }
+     }
+     if (s->state == MIGRATION_STATUS_CANCELLING && s->block_inactive) {
+         Error *local_err = NULL;
+@@ -1520,12 +1522,14 @@ void qmp_migrate_pause(Error **errp)
+ {
+     MigrationState *ms = migrate_get_current();
+     MigrationIncomingState *mis = migration_incoming_get_current();
+-    int ret;
++    int ret = 0;
+ 
+     if (ms->state == MIGRATION_STATUS_POSTCOPY_ACTIVE) {
+         /* Source side, during postcopy */
+         qemu_mutex_lock(&ms->qemu_file_lock);
+-        ret = qemu_file_shutdown(ms->to_dst_file);
++        if (ms->to_dst_file) {
++            ret = qemu_file_shutdown(ms->to_dst_file);
++        }
+         qemu_mutex_unlock(&ms->qemu_file_lock);
+         if (ret) {
+             error_setg(errp, "Failed to pause source migration");
+-- 
+2.39.3
+

kvm-migration-Fix-possible-races-when-shutting-down-the-.patch

@@ -0,0 +1,74 @@
+From 1cc26aac30b883244e300d872fa3a19f39afbb66 Mon Sep 17 00:00:00 2001
+From: Fabiano Rosas <farosas@suse.de>
+Date: Mon, 18 Sep 2023 14:28:17 -0300
+Subject: [PATCH 03/13] migration: Fix possible races when shutting down the
+ return path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [3/8] d734387cf07e956a1f1e817c200e5b36cf0a00b1 (peterx/qemu-kvm)
+
+We cannot call qemu_file_shutdown() on the return path file without
+taking the file lock. The return path thread could be running it's
+cleanup code and have just cleared the from_dst_file pointer.
+
+Checking ms->to_dst_file for errors could also race with
+migrate_fd_cleanup() which clears the to_dst_file pointer.
+
+Protect both accesses by taking the file lock.
+
+This was caught by inspection, it should be rare, but the next patches
+will start calling this code from other places, so let's do the
+correct thing.
+
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-4-farosas@suse.de>
+(cherry picked from commit 639decf529793fc544c8055b82be8abe77fa48fa)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index b92c6ae436..517b3e04d2 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -2053,17 +2053,18 @@ static int open_return_path_on_source(MigrationState *ms,
+ static int await_return_path_close_on_source(MigrationState *ms)
+ {
+     /*
+-     * If this is a normal exit then the destination will send a SHUT and the
+-     * rp_thread will exit, however if there's an error we need to cause
+-     * it to exit.
++     * If this is a normal exit then the destination will send a SHUT
++     * and the rp_thread will exit, however if there's an error we
++     * need to cause it to exit. shutdown(2), if we have it, will
++     * cause it to unblock if it's stuck waiting for the destination.
+      */
+-    if (qemu_file_get_error(ms->to_dst_file) && ms->rp_state.from_dst_file) {
+-        /*
+-         * shutdown(2), if we have it, will cause it to unblock if it's stuck
+-         * waiting for the destination.
+-         */
+-        qemu_file_shutdown(ms->rp_state.from_dst_file);
++    WITH_QEMU_LOCK_GUARD(&ms->qemu_file_lock) {
++        if (ms->to_dst_file && ms->rp_state.from_dst_file &&
++            qemu_file_get_error(ms->to_dst_file)) {
++            qemu_file_shutdown(ms->rp_state.from_dst_file);
++        }
+     }
++
+     trace_await_return_path_close_on_source_joining();
+     qemu_thread_join(&ms->rp_state.rp_thread);
+     ms->rp_state.rp_thread_created = false;
+-- 
+2.39.3
+

kvm-migration-Fix-race-that-dest-preempt-thread-close-to.patch

@@ -0,0 +1,172 @@
+From c98eb88ce49927f612753b53c890135fde14c3a4 Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Mon, 18 Sep 2023 14:28:15 -0300
+Subject: [PATCH 01/13] migration: Fix race that dest preempt thread close too
+ early
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [1/8] a1197ca99878d5d8bbb271c6941aa36d91c66122 (peterx/qemu-kvm)
+
+We hit intermit CI issue on failing at migration-test over the unit test
+preempt/plain:
+
+qemu-system-x86_64: Unable to read from socket: Connection reset by peer
+Memory content inconsistency at 5b43000 first_byte = bd last_byte = bc current = 4f hit_edge = 1
+**
+ERROR:../tests/qtest/migration-test.c:300:check_guests_ram: assertion failed: (bad == 0)
+(test program exited with status code -6)
+
+Fabiano debugged into it and found that the preempt thread can quit even
+without receiving all the pages, which can cause guest not receiving all
+the pages and corrupt the guest memory.
+
+To make sure preempt thread finished receiving all the pages, we can rely
+on the page_requested_count being zero because preempt channel will only
+receive requested page faults. Note, not all the faulted pages are required
+to be sent via the preempt channel/thread; imagine the case when a
+requested page is just queued into the background main channel for
+migration, the src qemu will just still send it via the background channel.
+
+Here instead of spinning over reading the count, we add a condvar so the
+main thread can wait on it if that unusual case happened, without burning
+the cpu for no good reason, even if the duration is short; so even if we
+spin in this rare case is probably fine.  It's just better to not do so.
+
+The condvar is only used when that special case is triggered.  Some memory
+ordering trick is needed to guarantee it from happening (against the
+preempt thread status field), so the main thread will always get a kick
+when that triggers correctly.
+
+Closes: https://gitlab.com/qemu-project/qemu/-/issues/1886
+Debugged-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-2-farosas@suse.de>
+(cherry picked from commit cf02f29e1e3843784630d04783e372fa541a77e5)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c    |  3 ++-
+ migration/migration.h    | 13 ++++++++++++-
+ migration/postcopy-ram.c | 38 +++++++++++++++++++++++++++++++++++++-
+ 3 files changed, 51 insertions(+), 3 deletions(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index 5528acb65e..6a7122694a 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -153,6 +153,7 @@ void migration_object_init(void)
+     qemu_sem_init(&current_incoming->postcopy_qemufile_dst_done, 0);
+ 
+     qemu_mutex_init(&current_incoming->page_request_mutex);
++    qemu_cond_init(&current_incoming->page_request_cond);
+     current_incoming->page_requested = g_tree_new(page_request_addr_cmp);
+ 
+     migration_object_check(current_migration, &error_fatal);
+@@ -367,7 +368,7 @@ int migrate_send_rp_req_pages(MigrationIncomingState *mis,
+              * things like g_tree_lookup() will return TRUE (1) when found.
+              */
+             g_tree_insert(mis->page_requested, aligned, (gpointer)1);
+-            mis->page_requested_count++;
++            qatomic_inc(&mis->page_requested_count);
+             trace_postcopy_page_req_add(aligned, mis->page_requested_count);
+         }
+     }
+diff --git a/migration/migration.h b/migration/migration.h
+index 6eea18db36..9a30216895 100644
+--- a/migration/migration.h
++++ b/migration/migration.h
+@@ -196,7 +196,10 @@ struct MigrationIncomingState {
+ 
+     /* A tree of pages that we requested to the source VM */
+     GTree *page_requested;
+-    /* For debugging purpose only, but would be nice to keep */
++    /*
++     * For postcopy only, count the number of requested page faults that
++     * still haven't been resolved.
++     */
+     int page_requested_count;
+     /*
+      * The mutex helps to maintain the requested pages that we sent to the
+@@ -210,6 +213,14 @@ struct MigrationIncomingState {
+      * contains valid information.
+      */
+     QemuMutex page_request_mutex;
++    /*
++     * If postcopy preempt is enabled, there is a chance that the main
++     * thread finished loading its data before the preempt channel has
++     * finished loading the urgent pages.  If that happens, the two threads
++     * will use this condvar to synchronize, so the main thread will always
++     * wait until all pages received.
++     */
++    QemuCond page_request_cond;
+ 
+     /*
+      * Number of devices that have yet to approve switchover. When this reaches
+diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
+index 29aea9456d..5408e028c6 100644
+--- a/migration/postcopy-ram.c
++++ b/migration/postcopy-ram.c
+@@ -599,6 +599,30 @@ int postcopy_ram_incoming_cleanup(MigrationIncomingState *mis)
+     if (mis->preempt_thread_status == PREEMPT_THREAD_CREATED) {
+         /* Notify the fast load thread to quit */
+         mis->preempt_thread_status = PREEMPT_THREAD_QUIT;
++        /*
++         * Update preempt_thread_status before reading count.  Note: mutex
++         * lock only provide ACQUIRE semantic, and it doesn't stops this
++         * write to be reordered after reading the count.
++         */
++        smp_mb();
++        /*
++         * It's possible that the preempt thread is still handling the last
++         * pages to arrive which were requested by guest page faults.
++         * Making sure nothing is left behind by waiting on the condvar if
++         * that unlikely case happened.
++         */
++        WITH_QEMU_LOCK_GUARD(&mis->page_request_mutex) {
++            if (qatomic_read(&mis->page_requested_count)) {
++                /*
++                 * It is guaranteed to receive a signal later, because the
++                 * count>0 now, so it's destined to be decreased to zero
++                 * very soon by the preempt thread.
++                 */
++                qemu_cond_wait(&mis->page_request_cond,
++                               &mis->page_request_mutex);
++            }
++        }
++        /* Notify the fast load thread to quit */
+         if (mis->postcopy_qemufile_dst) {
+             qemu_file_shutdown(mis->postcopy_qemufile_dst);
+         }
+@@ -1277,8 +1301,20 @@ static int qemu_ufd_copy_ioctl(MigrationIncomingState *mis, void *host_addr,
+          */
+         if (g_tree_lookup(mis->page_requested, host_addr)) {
+             g_tree_remove(mis->page_requested, host_addr);
+-            mis->page_requested_count--;
++            int left_pages = qatomic_dec_fetch(&mis->page_requested_count);
++
+             trace_postcopy_page_req_del(host_addr, mis->page_requested_count);
++            /* Order the update of count and read of preempt status */
++            smp_mb();
++            if (mis->preempt_thread_status == PREEMPT_THREAD_QUIT &&
++                left_pages == 0) {
++                /*
++                 * This probably means the main thread is waiting for us.
++                 * Notify that we've finished receiving the last requested
++                 * page.
++                 */
++                qemu_cond_signal(&mis->page_request_cond);
++            }
+         }
+         qemu_mutex_unlock(&mis->page_request_mutex);
+         mark_postcopy_blocktime_end((uintptr_t)host_addr);
+-- 
+2.39.3
+

kvm-migration-Move-return-path-cleanup-to-main-migration.patch

@@ -0,0 +1,76 @@
+From 117f325d4983bb7e40a50e51c2fe056938d5add4 Mon Sep 17 00:00:00 2001
+From: Fabiano Rosas <farosas@suse.de>
+Date: Mon, 18 Sep 2023 14:28:22 -0300
+Subject: [PATCH 08/13] migration: Move return path cleanup to main migration
+ thread
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [8/8] 3f085c4ac6c0835d35346bf0cad778c17a248daf (peterx/qemu-kvm)
+
+Now that the return path thread is allowed to finish during a paused
+migration, we can move the cleanup of the QEMUFiles to the main
+migration thread.
+
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-9-farosas@suse.de>
+(cherry picked from commit 36e9aab3c569d4c9ad780473596e18479838d1aa)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index a0782c64a1..7a4c8beb5d 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -98,6 +98,7 @@ static int migration_maybe_pause(MigrationState *s,
+                                  int *current_active_state,
+                                  int new_state);
+ static void migrate_fd_cancel(MigrationState *s);
++static int await_return_path_close_on_source(MigrationState *s);
+ 
+ static bool migration_needs_multiple_sockets(void)
+ {
+@@ -1178,6 +1179,12 @@ static void migrate_fd_cleanup(MigrationState *s)
+         qemu_fclose(tmp);
+     }
+ 
++    /*
++     * We already cleaned up to_dst_file, so errors from the return
++     * path might be due to that, ignore them.
++     */
++    await_return_path_close_on_source(s);
++
+     assert(!migration_is_active(s));
+ 
+     if (s->state == MIGRATION_STATUS_CANCELLING) {
+@@ -1986,7 +1993,6 @@ out:
+     }
+ 
+     trace_source_return_path_thread_end();
+-    migration_release_dst_files(ms);
+     rcu_unregister_thread();
+     return NULL;
+ }
+@@ -2040,6 +2046,9 @@ static int await_return_path_close_on_source(MigrationState *ms)
+ 
+     ret = ms->rp_state.error;
+     ms->rp_state.error = false;
++
++    migration_release_dst_files(ms);
++
+     trace_migration_return_path_end_after(ret);
+     return ret;
+ }
+-- 
+2.39.3
+

kvm-migration-Remove-redundant-cleanup-of-postcopy_qemuf.patch

@@ -0,0 +1,49 @@
+From be84138fc49f3e6998d6af8fdfa9cc1054ae1549 Mon Sep 17 00:00:00 2001
+From: Fabiano Rosas <farosas@suse.de>
+Date: Mon, 18 Sep 2023 14:28:19 -0300
+Subject: [PATCH 05/13] migration: Remove redundant cleanup of
+ postcopy_qemufile_src
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [5/8] 2a63a021e923e6460d57f1c0850651f4ddcd5b4f (peterx/qemu-kvm)
+
+This file is owned by the return path thread which is already doing
+cleanup.
+
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-6-farosas@suse.de>
+(cherry picked from commit b3b101157d4651f12e6b3361af2de6bace7f9b4a)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index 169e6bdce8..e2e4a7d8ae 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -1178,12 +1178,6 @@ static void migrate_fd_cleanup(MigrationState *s)
+         qemu_fclose(tmp);
+     }
+ 
+-    if (s->postcopy_qemufile_src) {
+-        migration_ioc_unregister_yank_from_file(s->postcopy_qemufile_src);
+-        qemu_fclose(s->postcopy_qemufile_src);
+-        s->postcopy_qemufile_src = NULL;
+-    }
+-
+     assert(!migration_is_active(s));
+ 
+     if (s->state == MIGRATION_STATUS_CANCELLING) {
+-- 
+2.39.3
+

kvm-migration-Replace-the-return-path-retry-logic.patch

@@ -0,0 +1,251 @@
+From 74093a6ac7b5290965a2869512b998eac018a630 Mon Sep 17 00:00:00 2001
+From: Fabiano Rosas <farosas@suse.de>
+Date: Mon, 18 Sep 2023 14:28:21 -0300
+Subject: [PATCH 07/13] migration: Replace the return path retry logic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
+RH-Jira: RHEL-11219
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [7/8] 6b9d9b955f95ff14b47491865e7e45bfdcfc8a97 (peterx/qemu-kvm)
+
+Replace the return path retry logic with finishing and restarting the
+thread. This fixes a race when resuming the migration that leads to a
+segfault.
+
+Currently when doing postcopy we consider that an IO error on the
+return path file could be due to a network intermittency. We then keep
+the thread alive but have it do cleanup of the 'from_dst_file' and
+wait on the 'postcopy_pause_rp' semaphore. When the user issues a
+migrate resume, a new return path is opened and the thread is allowed
+to continue.
+
+There's a race condition in the above mechanism. It is possible for
+the new return path file to be setup *before* the cleanup code in the
+return path thread has had a chance to run, leading to the *new* file
+being closed and the pointer set to NULL. When the thread is released
+after the resume, it tries to dereference 'from_dst_file' and crashes:
+
+Thread 7 "return path" received signal SIGSEGV, Segmentation fault.
+[Switching to Thread 0x7fffd1dbf700 (LWP 9611)]
+0x00005555560e4893 in qemu_file_get_error_obj (f=0x0, errp=0x0) at ../migration/qemu-file.c:154
+154         return f->last_error;
+
+(gdb) bt
+ #0  0x00005555560e4893 in qemu_file_get_error_obj (f=0x0, errp=0x0) at ../migration/qemu-file.c:154
+ #1  0x00005555560e4983 in qemu_file_get_error (f=0x0) at ../migration/qemu-file.c:206
+ #2  0x0000555555b9a1df in source_return_path_thread (opaque=0x555556e06000) at ../migration/migration.c:1876
+ #3  0x000055555602e14f in qemu_thread_start (args=0x55555782e780) at ../util/qemu-thread-posix.c:541
+ #4  0x00007ffff38d76ea in start_thread (arg=0x7fffd1dbf700) at pthread_create.c:477
+ #5  0x00007ffff35efa6f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
+
+Here's the race (important bit is open_return_path happening before
+migration_release_dst_files):
+
+migration                 | qmp                         | return path
+--------------------------+-----------------------------+---------------------------------
+			    qmp_migrate_pause()
+			     shutdown(ms->to_dst_file)
+			      f->last_error = -EIO
+migrate_detect_error()
+ postcopy_pause()
+  set_state(PAUSED)
+  wait(postcopy_pause_sem)
+			    qmp_migrate(resume)
+			    migrate_fd_connect()
+			     resume = state == PAUSED
+			     open_return_path <-- TOO SOON!
+			     set_state(RECOVER)
+			     post(postcopy_pause_sem)
+							(incoming closes to_src_file)
+							res = qemu_file_get_error(rp)
+							migration_release_dst_files()
+							ms->rp_state.from_dst_file = NULL
+  post(postcopy_pause_rp_sem)
+							postcopy_pause_return_path_thread()
+							  wait(postcopy_pause_rp_sem)
+							rp = ms->rp_state.from_dst_file
+							goto retry
+							qemu_file_get_error(rp)
+							SIGSEGV
+-------------------------------------------------------------------------------------------
+
+We can keep the retry logic without having the thread alive and
+waiting. The only piece of data used by it is the 'from_dst_file' and
+it is only allowed to proceed after a migrate resume is issued and the
+semaphore released at migrate_fd_connect().
+
+Move the retry logic to outside the thread by waiting for the thread
+to finish before pausing the migration.
+
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20230918172822.19052-8-farosas@suse.de>
+(cherry picked from commit ef796ee93b313ed2f0b427ef30320417387d2ad5)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ migration/migration.c | 60 ++++++++-----------------------------------
+ migration/migration.h |  1 -
+ 2 files changed, 11 insertions(+), 50 deletions(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index ac4541b971..a0782c64a1 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -1776,18 +1776,6 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
+     }
+ }
+ 
+-/* Return true to retry, false to quit */
+-static bool postcopy_pause_return_path_thread(MigrationState *s)
+-{
+-    trace_postcopy_pause_return_path();
+-
+-    qemu_sem_wait(&s->postcopy_pause_rp_sem);
+-
+-    trace_postcopy_pause_return_path_continued();
+-
+-    return true;
+-}
+-
+ static int migrate_handle_rp_recv_bitmap(MigrationState *s, char *block_name)
+ {
+     RAMBlock *block = qemu_ram_block_by_name(block_name);
+@@ -1871,7 +1859,6 @@ static void *source_return_path_thread(void *opaque)
+     trace_source_return_path_thread_entry();
+     rcu_register_thread();
+ 
+-retry:
+     while (!ms->rp_state.error && !qemu_file_get_error(rp) &&
+            migration_is_setup_or_active(ms->state)) {
+         trace_source_return_path_thread_loop_top();
+@@ -1993,26 +1980,7 @@ retry:
+     }
+ 
+ out:
+-    res = qemu_file_get_error(rp);
+-    if (res) {
+-        if (res && migration_in_postcopy()) {
+-            /*
+-             * Maybe there is something we can do: it looks like a
+-             * network down issue, and we pause for a recovery.
+-             */
+-            migration_release_dst_files(ms);
+-            rp = NULL;
+-            if (postcopy_pause_return_path_thread(ms)) {
+-                /*
+-                 * Reload rp, reset the rest.  Referencing it is safe since
+-                 * it's reset only by us above, or when migration completes
+-                 */
+-                rp = ms->rp_state.from_dst_file;
+-                ms->rp_state.error = false;
+-                goto retry;
+-            }
+-        }
+-
++    if (qemu_file_get_error(rp)) {
+         trace_source_return_path_thread_bad_end();
+         mark_source_rp_bad(ms);
+     }
+@@ -2023,8 +1991,7 @@ out:
+     return NULL;
+ }
+ 
+-static int open_return_path_on_source(MigrationState *ms,
+-                                      bool create_thread)
++static int open_return_path_on_source(MigrationState *ms)
+ {
+     ms->rp_state.from_dst_file = qemu_file_get_return_path(ms->to_dst_file);
+     if (!ms->rp_state.from_dst_file) {
+@@ -2033,11 +2000,6 @@ static int open_return_path_on_source(MigrationState *ms,
+ 
+     trace_open_return_path_on_source();
+ 
+-    if (!create_thread) {
+-        /* We're done */
+-        return 0;
+-    }
+-
+     qemu_thread_create(&ms->rp_state.rp_thread, "return path",
+                        source_return_path_thread, ms, QEMU_THREAD_JOINABLE);
+     ms->rp_state.rp_thread_created = true;
+@@ -2077,6 +2039,7 @@ static int await_return_path_close_on_source(MigrationState *ms)
+     trace_await_return_path_close_on_source_close();
+ 
+     ret = ms->rp_state.error;
++    ms->rp_state.error = false;
+     trace_migration_return_path_end_after(ret);
+     return ret;
+ }
+@@ -2552,6 +2515,13 @@ static MigThrError postcopy_pause(MigrationState *s)
+         qemu_file_shutdown(file);
+         qemu_fclose(file);
+ 
++        /*
++         * We're already pausing, so ignore any errors on the return
++         * path and just wait for the thread to finish. It will be
++         * re-created when we resume.
++         */
++        await_return_path_close_on_source(s);
++
+         migrate_set_state(&s->state, s->state,
+                           MIGRATION_STATUS_POSTCOPY_PAUSED);
+ 
+@@ -2569,12 +2539,6 @@ static MigThrError postcopy_pause(MigrationState *s)
+         if (s->state == MIGRATION_STATUS_POSTCOPY_RECOVER) {
+             /* Woken up by a recover procedure. Give it a shot */
+ 
+-            /*
+-             * Firstly, let's wake up the return path now, with a new
+-             * return path channel.
+-             */
+-            qemu_sem_post(&s->postcopy_pause_rp_sem);
+-
+             /* Do the resume logic */
+             if (postcopy_do_resume(s) == 0) {
+                 /* Let's continue! */
+@@ -3264,7 +3228,7 @@ void migrate_fd_connect(MigrationState *s, Error *error_in)
+      * QEMU uses the return path.
+      */
+     if (migrate_postcopy_ram() || migrate_return_path()) {
+-        if (open_return_path_on_source(s, !resume)) {
++        if (open_return_path_on_source(s)) {
+             error_setg(&local_err, "Unable to open return-path for postcopy");
+             migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
+             migrate_set_error(s, local_err);
+@@ -3328,7 +3292,6 @@ static void migration_instance_finalize(Object *obj)
+     qemu_sem_destroy(&ms->rate_limit_sem);
+     qemu_sem_destroy(&ms->pause_sem);
+     qemu_sem_destroy(&ms->postcopy_pause_sem);
+-    qemu_sem_destroy(&ms->postcopy_pause_rp_sem);
+     qemu_sem_destroy(&ms->rp_state.rp_sem);
+     qemu_sem_destroy(&ms->rp_state.rp_pong_acks);
+     qemu_sem_destroy(&ms->postcopy_qemufile_src_sem);
+@@ -3348,7 +3311,6 @@ static void migration_instance_init(Object *obj)
+     migrate_params_init(&ms->parameters);
+ 
+     qemu_sem_init(&ms->postcopy_pause_sem, 0);
+-    qemu_sem_init(&ms->postcopy_pause_rp_sem, 0);
+     qemu_sem_init(&ms->rp_state.rp_sem, 0);
+     qemu_sem_init(&ms->rp_state.rp_pong_acks, 0);
+     qemu_sem_init(&ms->rate_limit_sem, 0);
+diff --git a/migration/migration.h b/migration/migration.h
+index 9a30216895..1034d617bf 100644
+--- a/migration/migration.h
++++ b/migration/migration.h
+@@ -393,7 +393,6 @@ struct MigrationState {
+ 
+     /* Needed by postcopy-pause state */
+     QemuSemaphore postcopy_pause_sem;
+-    QemuSemaphore postcopy_pause_rp_sem;
+     /*
+      * Whether we abort the migration if decompression errors are
+      * detected at the destination. It is left at false for qemu
+-- 
+2.39.3
+

kvm-tests-file-io-error-New-test.patch

@@ -0,0 +1,201 @@
+From dbf091dd32daae0999fb62b74f7c834b445f6bf1 Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Thu, 24 Aug 2023 17:53:44 +0200
+Subject: [PATCH 13/13] tests/file-io-error: New test
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
+RH-Jira: RHEL-7360
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [5/5] a07662c948f10bea7972a7d525b5941264651a4f (hreitz/qemu-kvm-c-9-s)
+
+This is a regression test for
+https://bugzilla.redhat.com/show_bug.cgi?id=2234374.
+
+All this test needs to do is trigger an I/O error inside of file-posix
+(specifically raw_co_prw()).  One reliable way to do this without
+requiring special privileges is to use a FUSE export, which allows us to
+inject any error that we want, e.g. via blkdebug.
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230824155345.109765-6-hreitz@redhat.com>
+[hreitz: Fixed test to be skipped when there is no FUSE support, to
+         suppress fusermount's allow_other warning, and to be skipped
+         with $IMGOPTSSYNTAX enabled]
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+(cherry picked from commit 380448464dd89291cf7fd7434be6c225482a334d)
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ tests/qemu-iotests/tests/file-io-error     | 119 +++++++++++++++++++++
+ tests/qemu-iotests/tests/file-io-error.out |  33 ++++++
+ 2 files changed, 152 insertions(+)
+ create mode 100755 tests/qemu-iotests/tests/file-io-error
+ create mode 100644 tests/qemu-iotests/tests/file-io-error.out
+
+diff --git a/tests/qemu-iotests/tests/file-io-error b/tests/qemu-iotests/tests/file-io-error
+new file mode 100755
+index 0000000000..88ee5f670c
+--- /dev/null
++++ b/tests/qemu-iotests/tests/file-io-error
+@@ -0,0 +1,119 @@
++#!/usr/bin/env bash
++# group: rw
++#
++# Produce an I/O error in file-posix, and hope that it is not catastrophic.
++# Regression test for: https://bugzilla.redhat.com/show_bug.cgi?id=2234374
++#
++# Copyright (C) 2023 Red Hat, Inc.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 2 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <http://www.gnu.org/licenses/>.
++#
++
++seq=$(basename "$0")
++echo "QA output created by $seq"
++
++status=1	# failure is the default!
++
++_cleanup()
++{
++    _cleanup_qemu
++    rm -f "$TEST_DIR/fuse-export"
++}
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++# get standard environment, filters and checks
++. ../common.rc
++. ../common.filter
++. ../common.qemu
++
++# Format-agnostic (we do not use any), but we do test the file protocol
++_supported_proto file
++_require_drivers blkdebug null-co
++
++if [ "$IMGOPTSSYNTAX" = "true" ]; then
++    # We need `$QEMU_IO -f file` to work; IMGOPTSSYNTAX uses --image-opts,
++    # breaking -f.
++    _unsupported_fmt $IMGFMT
++fi
++
++# This is a regression test of a bug in which flie-posix would access zone
++# information in case of an I/O error even when there is no zone information,
++# resulting in a division by zero.
++# To reproduce the problem, we need to trigger an I/O error inside of
++# file-posix, which can be done (rootless) by providing a FUSE export that
++# presents only errors when accessed.
++
++_launch_qemu
++_send_qemu_cmd $QEMU_HANDLE \
++    "{'execute': 'qmp_capabilities'}" \
++    'return'
++
++_send_qemu_cmd $QEMU_HANDLE \
++    "{'execute': 'blockdev-add',
++      'arguments': {
++          'driver': 'blkdebug',
++          'node-name': 'node0',
++          'inject-error': [{'event': 'none'}],
++          'image': {
++              'driver': 'null-co'
++          }
++      }}" \
++    'return'
++
++# FUSE mountpoint must exist and be a regular file
++touch "$TEST_DIR/fuse-export"
++
++# The grep -v to filter fusermount's (benign) error when /etc/fuse.conf does
++# not contain user_allow_other and the subsequent check for missing FUSE support
++# have both been taken from iotest 308.
++output=$(_send_qemu_cmd $QEMU_HANDLE \
++    "{'execute': 'block-export-add',
++      'arguments': {
++          'id': 'exp0',
++          'type': 'fuse',
++          'node-name': 'node0',
++          'mountpoint': '$TEST_DIR/fuse-export',
++          'writable': true
++      }}" \
++    'return' \
++    | grep -v 'option allow_other only allowed if')
++
++if echo "$output" | grep -q "Parameter 'type' does not accept value 'fuse'"; then
++    _notrun 'No FUSE support'
++fi
++echo "$output"
++
++echo
++# This should fail, but gracefully, i.e. just print an I/O error, not crash.
++$QEMU_IO -f file -c 'write 0 64M' "$TEST_DIR/fuse-export" | _filter_qemu_io
++echo
++
++_send_qemu_cmd $QEMU_HANDLE \
++    "{'execute': 'block-export-del',
++      'arguments': {'id': 'exp0'}}" \
++    'return'
++
++_send_qemu_cmd $QEMU_HANDLE \
++    '' \
++    'BLOCK_EXPORT_DELETED'
++
++_send_qemu_cmd $QEMU_HANDLE \
++    "{'execute': 'blockdev-del',
++      'arguments': {'node-name': 'node0'}}" \
++    'return'
++
++# success, all done
++echo "*** done"
++rm -f $seq.full
++status=0
+diff --git a/tests/qemu-iotests/tests/file-io-error.out b/tests/qemu-iotests/tests/file-io-error.out
+new file mode 100644
+index 0000000000..0f46455a94
+--- /dev/null
++++ b/tests/qemu-iotests/tests/file-io-error.out
+@@ -0,0 +1,33 @@
++QA output created by file-io-error
++{'execute': 'qmp_capabilities'}
++{"return": {}}
++{'execute': 'blockdev-add',
++      'arguments': {
++          'driver': 'blkdebug',
++          'node-name': 'node0',
++          'inject-error': [{'event': 'none'}],
++          'image': {
++              'driver': 'null-co'
++          }
++      }}
++{"return": {}}
++{'execute': 'block-export-add',
++      'arguments': {
++          'id': 'exp0',
++          'type': 'fuse',
++          'node-name': 'node0',
++          'mountpoint': 'TEST_DIR/fuse-export',
++          'writable': true
++      }}
++{"return": {}}
++
++write failed: Input/output error
++
++{'execute': 'block-export-del',
++      'arguments': {'id': 'exp0'}}
++{"return": {}}
++{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "exp0"}}
++{'execute': 'blockdev-del',
++      'arguments': {'node-name': 'node0'}}
++{"return": {}}
++*** done
+-- 
+2.39.3
+

kvm-virtio-Drop-out-of-coroutine-context-in-virtio_load.patch

@@ -0,0 +1,151 @@
+From be5adda1bfc78fea3655ee7a2e11048cfcd9247c Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Tue, 5 Sep 2023 16:50:02 +0200
+Subject: [PATCH] virtio: Drop out of coroutine context in virtio_load()
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 201: virtio: Drop out of coroutine context in virtio_load()
+RH-Jira: RHEL-832
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [1/1] 64ca84cf9bd82eb9e22a1840909e99958ceb51a6 (kmwolf/centos-qemu-kvm)
+
+virtio_load() as a whole should run in coroutine context because it
+reads from the migration stream and we don't want this to block.
+
+However, it calls virtio_set_features_nocheck() and devices don't
+expect their .set_features callback to run in a coroutine and therefore
+call functions that may not be called in coroutine context. To fix this,
+drop out of coroutine context for calling virtio_set_features_nocheck().
+
+Without this fix, the following crash was reported:
+
+  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
+  #1  0x00007efc738c05d3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
+  #2  0x00007efc73873d26 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
+  #3  0x00007efc738477f3 in __GI_abort () at abort.c:79
+  #4  0x00007efc7384771b in __assert_fail_base (fmt=0x7efc739dbcb8 "", assertion=assertion@entry=0x560aebfbf5cf "!qemu_in_coroutine()",
+     file=file@entry=0x560aebfcd2d4 "../block/graph-lock.c", line=line@entry=275, function=function@entry=0x560aebfcd34d "void bdrv_graph_rdlock_main_loop(void)") at assert.c:92
+  #5  0x00007efc7386ccc6 in __assert_fail (assertion=0x560aebfbf5cf "!qemu_in_coroutine()", file=0x560aebfcd2d4 "../block/graph-lock.c", line=275,
+     function=0x560aebfcd34d "void bdrv_graph_rdlock_main_loop(void)") at assert.c:101
+  #6  0x0000560aebcd8dd6 in bdrv_register_buf ()
+  #7  0x0000560aeb97ed97 in ram_block_added.llvm ()
+  #8  0x0000560aebb8303f in ram_block_add.llvm ()
+  #9  0x0000560aebb834fa in qemu_ram_alloc_internal.llvm ()
+  #10 0x0000560aebb2ac98 in vfio_region_mmap ()
+  #11 0x0000560aebb3ea0f in vfio_bars_register ()
+  #12 0x0000560aebb3c628 in vfio_realize ()
+  #13 0x0000560aeb90f0c2 in pci_qdev_realize ()
+  #14 0x0000560aebc40305 in device_set_realized ()
+  #15 0x0000560aebc48e07 in property_set_bool.llvm ()
+  #16 0x0000560aebc46582 in object_property_set ()
+  #17 0x0000560aebc4cd58 in object_property_set_qobject ()
+  #18 0x0000560aebc46ba7 in object_property_set_bool ()
+  #19 0x0000560aeb98b3ca in qdev_device_add_from_qdict ()
+  #20 0x0000560aebb1fbaf in virtio_net_set_features ()
+  #21 0x0000560aebb46b51 in virtio_set_features_nocheck ()
+  #22 0x0000560aebb47107 in virtio_load ()
+  #23 0x0000560aeb9ae7ce in vmstate_load_state ()
+  #24 0x0000560aeb9d2ee9 in qemu_loadvm_state_main ()
+  #25 0x0000560aeb9d45e1 in qemu_loadvm_state ()
+  #26 0x0000560aeb9bc32c in process_incoming_migration_co.llvm ()
+  #27 0x0000560aebeace56 in coroutine_trampoline.llvm ()
+
+Cc: qemu-stable@nongnu.org
+Buglink: https://issues.redhat.com/browse/RHEL-832
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20230905145002.46391-3-kwolf@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 92e2e6a867334a990f8d29f07ca34e3162fdd6ec)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ hw/virtio/virtio.c | 45 ++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 40 insertions(+), 5 deletions(-)
+
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
+index 309038fd46..969c25f4cf 100644
+--- a/hw/virtio/virtio.c
++++ b/hw/virtio/virtio.c
+@@ -2825,8 +2825,9 @@ static int virtio_device_put(QEMUFile *f, void *opaque, size_t size,
+ }
+ 
+ /* A wrapper for use as a VMState .get function */
+-static int virtio_device_get(QEMUFile *f, void *opaque, size_t size,
+-                             const VMStateField *field)
++static int coroutine_mixed_fn
++virtio_device_get(QEMUFile *f, void *opaque, size_t size,
++                  const VMStateField *field)
+ {
+     VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
+     DeviceClass *dc = DEVICE_CLASS(VIRTIO_DEVICE_GET_CLASS(vdev));
+@@ -2853,6 +2854,39 @@ static int virtio_set_features_nocheck(VirtIODevice *vdev, uint64_t val)
+     return bad ? -1 : 0;
+ }
+ 
++typedef struct VirtioSetFeaturesNocheckData {
++    Coroutine *co;
++    VirtIODevice *vdev;
++    uint64_t val;
++    int ret;
++} VirtioSetFeaturesNocheckData;
++
++static void virtio_set_features_nocheck_bh(void *opaque)
++{
++    VirtioSetFeaturesNocheckData *data = opaque;
++
++    data->ret = virtio_set_features_nocheck(data->vdev, data->val);
++    aio_co_wake(data->co);
++}
++
++static int coroutine_mixed_fn
++virtio_set_features_nocheck_maybe_co(VirtIODevice *vdev, uint64_t val)
++{
++    if (qemu_in_coroutine()) {
++        VirtioSetFeaturesNocheckData data = {
++            .co = qemu_coroutine_self(),
++            .vdev = vdev,
++            .val = val,
++        };
++        aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
++                                virtio_set_features_nocheck_bh, &data);
++        qemu_coroutine_yield();
++        return data.ret;
++    } else {
++        return virtio_set_features_nocheck(vdev, val);
++    }
++}
++
+ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
+ {
+     int ret;
+@@ -2906,7 +2940,8 @@ size_t virtio_get_config_size(const VirtIOConfigSizeParams *params,
+     return config_size;
+ }
+ 
+-int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
++int coroutine_mixed_fn
++virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
+ {
+     int i, ret;
+     int32_t config_len;
+@@ -3023,14 +3058,14 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
+          * host_features.
+          */
+         uint64_t features64 = vdev->guest_features;
+-        if (virtio_set_features_nocheck(vdev, features64) < 0) {
++        if (virtio_set_features_nocheck_maybe_co(vdev, features64) < 0) {
+             error_report("Features 0x%" PRIx64 " unsupported. "
+                          "Allowed features: 0x%" PRIx64,
+                          features64, vdev->host_features);
+             return -1;
+         }
+     } else {
+-        if (virtio_set_features_nocheck(vdev, features) < 0) {
++        if (virtio_set_features_nocheck_maybe_co(vdev, features) < 0) {
+             error_report("Features 0x%x unsupported. "
+                          "Allowed features: 0x%" PRIx64,
+                          features, vdev->host_features);
+-- 
+2.39.3
+

qemu.spec

@@ -149,7 +149,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
 Version: 8.1.0
-Release: 0%{?rcrel}%{?dist}%{?cc_suffix}
+Release: 3%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@@ -172,26 +172,55 @@ Source28: 95-kvm-memlock.conf
 Source30: kvm-s390x.conf
 Source31: kvm-x86.conf
 Source36: README.tests
-Patch1: 0001-Initial-redhat-build.patch
-Patch2: 0002-Enable-disable-devices-for-RHEL.patch
-Patch3: 0003-Machine-type-related-general-changes.patch
-Patch4: 0004-Add-aarch64-machine-types.patch
-Patch5: 0005-Add-ppc64-machine-types.patch
-Patch6: 0006-Add-s390x-machine-types.patch
-Patch7: 0007-Add-x86_64-machine-types.patch
-Patch8: 0008-Enable-make-check.patch
-Patch9: 0009-vfio-cap-number-of-devices-that-can-be-assigned.patch
-Patch10: 0010-Add-support-statement-to-help-output.patch
-Patch11: 0011-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
-Patch12: 0012-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
-Patch13: kvm-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch
-Patch14: kvm-vdpa-export-vhost_vdpa_set_vring_ready.patch
-Patch15: kvm-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch
-Patch16: 0016-vdpa-move-vhost_vdpa_set_vring_ready-to-the-caller.patch
-Patch17: kvm-vdpa-remove-net-cvq-migration-blocker.patch
-Patch18: 0018-Add-machine-types-compat-bits.patch
-Patch19: 0019-Fix-x86-machine-type-compatibility-for-qemu-kvm-8.1..patch
 
+Patch0003: kvm-fix-clang17-s390x.patch
+Patch0004: 0004-Initial-redhat-build.patch
+Patch0005: 0005-Enable-disable-devices-for-RHEL.patch
+Patch0006: 0006-Machine-type-related-general-changes.patch
+Patch0007: 0007-Add-aarch64-machine-types.patch
+Patch0008: 0008-Add-ppc64-machine-types.patch
+Patch0009: 0009-Add-s390x-machine-types.patch
+Patch0010: 0010-Add-x86_64-machine-types.patch
+Patch0011: 0011-Enable-make-check.patch
+Patch0012: 0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
+Patch0013: 0013-Add-support-statement-to-help-output.patch
+Patch0014: 0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+Patch0015: 0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+Patch0016: 0016-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch
+Patch0017: 0017-vdpa-export-vhost_vdpa_set_vring_ready.patch
+Patch0018: 0018-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch
+Patch0019: 0019-vdpa-move-vhost_vdpa_set_vring_ready-to-the-caller.patch
+Patch0020: 0020-vdpa-remove-net-cvq-migration-blocker.patch
+Patch0021: 0021-Add-machine-types-compat-bits.patch
+Patch0022: 0022-Fix-x86-machine-type-compatibility-for-qemu-kvm-8.1..patch
+# For RHEL-832 - qemu-kvm crashed when migrating guest with failover vf
+Patch23: kvm-virtio-Drop-out-of-coroutine-context-in-virtio_load.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch24: kvm-migration-Fix-race-that-dest-preempt-thread-close-to.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch25: kvm-migration-Fix-possible-race-when-setting-rp_state.er.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch26: kvm-migration-Fix-possible-races-when-shutting-down-the-.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch27: kvm-migration-Fix-possible-race-when-shutting-down-to_ds.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch28: kvm-migration-Remove-redundant-cleanup-of-postcopy_qemuf.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch29: kvm-migration-Consolidate-return-path-closing-code.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch30: kvm-migration-Replace-the-return-path-retry-logic.patch
+# For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
+Patch31: kvm-migration-Move-return-path-cleanup-to-main-migration.patch
+# For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
+Patch32: kvm-file-posix-Clear-bs-bl.zoned-on-error.patch
+# For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
+Patch33: kvm-file-posix-Check-bs-bl.zoned-for-zone-info.patch
+# For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
+Patch34: kvm-file-posix-Fix-zone-update-in-I-O-error-path.patch
+# For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
+Patch35: kvm-file-posix-Simplify-raw_co_prw-s-out-zone-code.patch
+# For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
+Patch36: kvm-tests-file-io-error-New-test.patch
 
 %if %{have_clang}
 BuildRequires: clang
@@ -1251,6 +1280,35 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif
 
 %changelog
+* Mon Oct 16 2023 Miroslav Rezanina <mrezanin@redhat.com> - 8.1.0-3
+- kvm-migration-Fix-race-that-dest-preempt-thread-close-to.patch [RHEL-11219]
+- kvm-migration-Fix-possible-race-when-setting-rp_state.er.patch [RHEL-11219]
+- kvm-migration-Fix-possible-races-when-shutting-down-the-.patch [RHEL-11219]
+- kvm-migration-Fix-possible-race-when-shutting-down-to_ds.patch [RHEL-11219]
+- kvm-migration-Remove-redundant-cleanup-of-postcopy_qemuf.patch [RHEL-11219]
+- kvm-migration-Consolidate-return-path-closing-code.patch [RHEL-11219]
+- kvm-migration-Replace-the-return-path-retry-logic.patch [RHEL-11219]
+- kvm-migration-Move-return-path-cleanup-to-main-migration.patch [RHEL-11219]
+- kvm-file-posix-Clear-bs-bl.zoned-on-error.patch [RHEL-7360]
+- kvm-file-posix-Check-bs-bl.zoned-for-zone-info.patch [RHEL-7360]
+- kvm-file-posix-Fix-zone-update-in-I-O-error-path.patch [RHEL-7360]
+- kvm-file-posix-Simplify-raw_co_prw-s-out-zone-code.patch [RHEL-7360]
+- kvm-tests-file-io-error-New-test.patch [RHEL-7360]
+- Resolves: RHEL-11219
+  (migration tests failing for RHEL 9.4 sometimes)
+- Resolves: RHEL-7360
+  (Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk)
+
+* Mon Oct 02 2023 Miroslav Rezanina <mrezanin@redhat.com> - 8.1.0-2
+- kvm-virtio-Drop-out-of-coroutine-context-in-virtio_load.patch [RHEL-832]
+- Resolves: RHEL-832
+  (qemu-kvm crashed when migrating guest with failover vf)
+
+* Mon Sep 04 2023 Miroslav Rezanina <mrezanin@redhat.com> - 8.1.0-1
+- Rebase to QEMU 8.1 [RHEL-870]
+- Resolves: RHEL-870
+  (Rebase qemu-kvm to QEMU 8.1.0)
+
 * Thu Aug 24 2023 Miroslav Rezanina <mrezanin@redhat.com> - 8.0.0-13
 - kvm-vdpa-return-errno-in-vhost_vdpa_get_vring_group-erro.patch [RHEL-923]
 - kvm-vdpa-move-CVQ-isolation-check-to-net_init_vhost_vdpa.patch [RHEL-923]